Typed Memory Management in a Calculus of Capabilities David Walker (with Karl Crary and Greg Morrisett)

PoPL '99David Walker, Cornell University2 The TAL Project Verify GC System Interface LinkCompile CodeTypes CodeTypes CodeTypes Code

PoPL '99David Walker, Cornell University3 TAL Goals Security –reduce the trusted computing base Software Engineering –eliminate dynamic failure modes; use static checking Flexibility –give programmers control over low-level details –admit varying compilation strategies

PoPL '99David Walker, Cornell University4 TAL Memory Management Garbage Collection: behind-the-scenes cleanup Problems: –Complex code in the trusted computing base –Under-specified invariants link client and collector (type tags, pointer restrictions, etc) –No control over memory management decisions Java, PCC, SPIN, ECC also use GC

PoPL '99David Walker, Cornell University5 Regions ( Tofte and Talpin ) Explicit but provably safe deallocation Static error checking Simple, constant-time routines Regions are allocated on a stack Objects are allocated into regions Topmost regions are deallocated

PoPL '99David Walker, Cornell University6 Towards Region-Based TAL letrgn  in f ( ) end;... more code region lifetime High-level Code:Low-level Code: Region lifetimes are unclear in low-level code Optimizations break the LIFO allocation structure CALL SITE: newrgn  ; mov r, RET; jmp f; RET: freergn  ; more code

PoPL '99David Walker, Cornell University7 Contributions The Capability Calculus: –A new statically-typed region-based intermediate language A syntactic proof of soundness Typed Assembly Language with primitives for safely allocating and freeing regions A translation from a variant of the Tofte- Talpin framework

PoPL '99David Walker, Cornell University8 A New Perspective Static Capabilities 22 11 22 x 11 Regions 22 Free region  1 x 11 22

PoPL '99David Walker, Cornell University9 The Capability Calculus A continuation-passing style language: e ::= let d in e | v[  1,...,  m ](v 1,...,v n ) |... With declarations for separate allocation and deallocation of regions: d ::= newrgn  | freergn  |  |...

PoPL '99David Walker, Cornell University10 Types Types: ints, tuples, polymorphic functions  –  [  ].(C,  1,...,  n ) ->  Capabilities: the collection of regions currently accessible –C ::= Ø |  | {  } | C 1  C 2 (first try)

PoPL '99David Walker, Cornell University11 An Example ; Initial Capability C = Ø let newrgn  1 newrgn  2 x  1 y  2 freergn  1 z =  1 y w =  1 z in... ; C = {  1 } ; C = {  1,  2 } ;  1 ok ;  2 ok ; C = {  2 } ;  2 ok ;  1 not ok! 234 y 22 11 4 y 22 z

PoPL '99David Walker, Cornell University12 A Second Example fun f[  1,  2 ]({  1,  2 }, x  2,...). let freergn  1 z =  1 x in... ; C = {  } f [ ,  ,...) ; C = {  1,  2 } ; C = {  2 } ;  2 ok ; instantiation causes  1 to alias  2 :

PoPL '99David Walker, Cornell University13 Aliasing Safe revocation requires that all copies of a capability be deleted Type instantiation creates aliases No local analysis can detect these aliases

PoPL '99David Walker, Cornell University14 Previous Work Linear Type Systems (Girard,Wadler,...) Syntactic Control of Interference (Reynolds) These systems prevent aliasing; we need to track aliasing.

PoPL '99David Walker, Cornell University15 Alias Tracking New Capabilities: {  1 } and {  + } {  1 } indicates  is unique {  + } indicates  is duplicatable {  + } = {  +,  + } but {  1 }  {  1,  1 } {  +,  + } is good but {  1,  1 } is bad

PoPL '99David Walker, Cornell University16 Safe Deallocation ; Capability = C newrgn  ; Capability = C  {  1 } freergn  ; Capability = C

PoPL '99David Walker, Cornell University17 An Example Revisited fun f[  1,  2 ]({  1 1,  2 1 }, x  2,...). let freergn  1 z =  1 x in... ; C = {   } f [ ,  ,...) ; C = {  3 1,  4 1 } f [  3,  4  4, …) ; C = {  1 1,  2 1 } ;  1 unique, C = {  2 1 } ;  2 ok ; No: {  1 }  {  1,  1 } ; Yes!

PoPL '99David Walker, Cornell University18 Subcapabilities Duplicatable capabilities: necessary to make functions sufficiently polymorphic Unique capabilities provide all of the privileges of duplicatable capabilities: {  1 }  {  + }

PoPL '99David Walker, Cornell University19 Using Subcapabilities fun g[  ,   ]({   +,   + },  ,  ,...). … ; neither region is deallocated ; Current Capability = {  1 } let x  in g [ ,  ](x, x,...) ; ok: {  1 }  {  + } = {  +,  + }

PoPL '99David Walker, Cornell University20 Final Pieces Solution: bounded quantification allocate regions ; grants unique capabilities... | jump to f ; lose some privileges: {  1 }  {  + } |... deallocate regions ; requires unique capabilities, ; but we’ve given them up...

PoPL '99David Walker, Cornell University21 BQ Example let newrgn  ; capability C = {  1 }... ; f:  [  ,  ,   {   +,   + }]. ( ,..., ( ,...) ->   ) -> ... ; cont: ({  1 },...) -> , frees region  in f [ , , {  1 }](..., cont) ; ok: {  1 }  {  + } = {  +,  + }

PoPL '99David Walker, Cornell University22 Related Work Region inference –Tofte and Talpin (PoPL ‘94) –Aiken et al. (PoPL ‘95) –Birkedal et al. (PoPL ‘96) –ML Kit with regions Effect Systems, Monads Linear Types, Syntactic Control of Interference

PoPL '99David Walker, Cornell University23 Summary Capabilities govern access to sensitive data We control capability aliasing by tracking uniqueness information The result: flexible and provably safe deallocation